chown :root /etc/audit/audit*.{rules,conf} /etc/audit/rules.d/*